KRACK vulnerability

Question

What is the Sophos position on the KRACK vulnerability in WPA2? Are we safe, when will we see a patch if we're not? Many vendors have already released statements with models affect, patches and work-arounds. Cisco, Aruba, Ubiqiti, Microsoft, etc.

This thread was automatically locked due to age.

Grammaton · Answer

So what you are saying is that the new modus operandi for any new vulnerability disclosure is to give the vendors a week to fix it before public disclosure? Since, based on this example (and SOPHOS is only one of many corporations guilty of this...except for Microsoft they patched it before it went public) the vendors would just sit on the vulnerability without it being patched unless that specific vulnerability gains public exposure. 
 
 Sophos had 7 weeks to patch and test the patch. So the whole "the necessary patch and after full implementation and testing on our solutions, we will be able to release a fix. This process can take a number of days" should have been finished by September 20th at most (it was disclosed to them on the 5th, I think 15 days for a simple change 4 reply to 2 reply or 1 reply should be be an easy fix) I mean DD-WRT firmware folks (1 guy "team") did it in 2 hours and all of the routers running that open source firmware are OK now without any issue, yes I am comparing public to corporate world/solutions hence I am giving the SOPHOS team a 15 day slack to test it...if DD-WRT can issue the fix in 2 hours (only reason why it was late is because they worked off the public release, the devs didn't have the privy to early info), then a corporate world should fix the same issue and have it tested within 15 days. 
 
 All of this exposes the whole security by obscurity patch theater: "Just because it's not public then we are safe"....yeah, but as any other invention in our time, just because one person found it, it doesn't mean that others didn't either. 
 
 What this needs is the Game of Thrones SHAME BELL!